feat(config): deliver to always-mTLS Maestro peer edge (CN=maestro gate)

- /config delivery now targets the service's dedicated Maestro peer listener:
  https + authmgmt.MaestroTransport() (Maestro's own mTLS identity, never
  downgraded in dev), port from org.dcntrlized.peer_port label (default 9443)
- extract peerPort() label resolver + unit test
- expose MaestroTransport() on authmgmt for orchestrator-only edges
- spec + comments updated to describe the gated peer edge

spec.yaml

@@ -989,7 +989,10 @@ paths:
         returned again — the response is only a ServiceConfigEntry with set:true.
         The value is injected as the field's env key at start, and, when the
         service is running and exposes POST /config (D6 write-back), delivered
-        to it at runtime over the mTLS peer edge.
+        to it at runtime. Delivery always targets the service's dedicated
+        Maestro peer listener (org.dcntrlized.peer_port label, default 9443)
+        over https with Maestro's own mTLS identity — CN=maestro is how the
+        service's /config gate authorizes the caller.
       requestBody:
         required: true
         content:
@@ -1016,7 +1019,12 @@ paths:
       tags: ["service-config"]
       description: >-
         Owner-gated (Service Config & Secrets theme M1). Removes the stored
-        value; on the next start the compose file's own default applies.
+        value; on the next start the compose file's own default applies. When
+        the service is running and exposes POST /config (D6 write-back), a
+        best-effort clear {field, action:"clear"} is delivered at runtime (same
+        https + Maestro mTLS identity edge, to the service's peer port, 9443 by
+        default) so the running process drops the value immediately
+        instead of waiting for a restart.
       responses:
         '200':
           description: Value cleared